CVE-2026-14680
Received Received - Intake

Type Confusion in PostgreSQL Leading to Arbitrary Code Execution

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: PostgreSQL

Description
Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-14680
EUVD
EUVD-2026-57844

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
postgresql postgresql to 14.24 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-843 The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a type confusion vulnerability in PostgreSQL where improper handling of the 'internal' data type allows any authenticated user to execute arbitrary code with the privileges of the operating system user running the database. The 'internal' type is meant for internal PostgreSQL operations and not direct SQL access, but safeguards against misuse had gaps.

Detection Guidance

Detecting this vulnerability requires checking PostgreSQL versions against affected releases. Run 'postgres --version' or check package managers like 'apt list --installed | grep postgresql' or 'yum list installed postgresql-server'. If your version is below 18.5, 17.11, 16.15, 15.19, or 14.24, the system is vulnerable.

Impact Analysis

An attacker could gain full control over the database server, leading to unauthorized data access, modification, or deletion. They could also execute system-level commands, potentially compromising the entire host system.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or manipulation, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Non-compliance risks include legal penalties and reputational damage.

Mitigation Strategies

Immediately update PostgreSQL to the latest patched versions: 18.5, 17.11, 16.15, 15.19, or 14.24. If updating is not possible, restrict database access to trusted users only and avoid using functions with 'internal' data type arguments until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14680. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart